60291 2011-05-05 12:29:49 -0700 Block callbacks delivered during destruction 2011-06-03 14:05:17 -0700 1 1 1 Unclassified WebKit Media 528+ (Nightly build) Unspecified Unspecified RESOLVED FIXED InRadar, PlatformOnly P2 Normal --- 1 eric.carlson eric.carlson abarth ademar eric webkit.review.bot oldest_to_newest 398926 0 eric.carlson 2011-05-05 12:29:49 -0700 If -[AVAsset cancelLoading] is called while the asset is checking the "playable" property, it will call the completion handler to report that the asset is not playable. This callback triggers a networkState change and a callback to HTMLMediaElement. This can cause a crash if the load was cancelled because the media element was released or stopped: Thread 0 Crashed:: Dispatch queue: com.apple.main-thread 0 com.apple.WebCore 0x000000010ddf0a0e unsigned int WTF::StringHasher::computeHash<unsigned short, &(WTF::StringHasher::defaultCoverter(unsigned short))>(unsigned short const*, unsigned int) + 126 1 com.apple.WebCore 0x000000010ddf097b unsigned int WTF::StringHasher::computeHash<unsigned short>(unsigned short const*, unsigned int) + 27 2 com.apple.WebCore 0x000000010ddf0942 WTF::StringImpl::hash() const + 50 3 com.apple.WebCore 0x000000010ddf08fd WTF::StringHash::hash(WTF::String const&) + 29 4 com.apple.WebCore 0x000000010df00085 WTF::IdentityHashTranslator<WTF::String, WTF::String, WTF::StringHash>::hash(WTF::String const&) + 21 5 com.apple.WebCore 0x000000010df00536 WTF::String* WTF::HashTable<WTF::String, WTF::String, WTF::IdentityExtractor<WTF::String>, WTF::StringHash, WTF::HashTraits<WTF::String>, WTF::HashTraits<WTF::String> >::lookup<WTF::String, WTF::IdentityHashTranslator<WTF::String, WTF::String, WTF::StringHash> >(WTF::String const&) + 70 6 com.apple.WebCore 0x000000010df8774e bool WTF::HashTable<WTF::String, WTF::String, WTF::IdentityExtractor<WTF::String>, WTF::StringHash, WTF::HashTraits<WTF::String>, WTF::HashTraits<WTF::String> >::contains<WTF::String, WTF::IdentityHashTranslator<WTF::String, WTF::String, WTF::StringHash> >(WTF::String const&) const + 62 7 com.apple.WebCore 0x000000010df876f9 WTF::HashTable<WTF::String, WTF::String, WTF::IdentityExtractor<WTF::String>, WTF::StringHash, WTF::HashTraits<WTF::String>, WTF::HashTraits<WTF::String> >::contains(WTF::String const&) const + 25 8 com.apple.WebCore 0x000000010df7e289 WTF::HashSet<WTF::String, WTF::StringHash, WTF::HashTraits<WTF::String> >::contains(WTF::String const&) const + 25 9 com.apple.WebCore 0x000000010edc87ed WebCore::MediaPlayerPrivateQTKit::supportsType(WTF::String const&, WTF::String const&) + 61 10 com.apple.WebCore 0x000000010edb877f WebCore::bestMediaEngineForTypeAndCodecs(WTF::String const&, WTF::String const&, WebCore::MediaPlayerFactory*) + 319 11 com.apple.WebCore 0x000000010edb9ed6 WebCore::MediaPlayer::networkStateChanged() + 230 12 com.apple.WebCore 0x000000010edbd298 WebCore::MediaPlayerPrivateAVFoundation::updateStates() + 984 13 com.apple.WebCore 0x000000010edbce32 WebCore::MediaPlayerPrivateAVFoundation::playabilityKnown() + 50 14 com.apple.WebCore 0x000000010edbeb42 WebCore::MediaPlayerPrivateAVFoundation::dispatchNotification() + 994 15 com.apple.WebCore 0x000000010edbedc0 WebCore::MediaPlayerPrivateAVFoundation::scheduleMainThreadNotification(WebCore::MediaPlayerPrivateAVFoundation::Notification) + 320 16 com.apple.WebCore 0x000000010edbec70 WebCore::MediaPlayerPrivateAVFoundation::scheduleMainThreadNotification(WebCore::MediaPlayerPrivateAVFoundation::Notification::Type, double) + 96 17 com.apple.WebCore 0x000000010edc5dac -[WebCoreAVFMovieObserver playableKnown] + 92 18 com.apple.WebCore 0x000000010edc1f28 __checkPlayability_block_invoke_0 + 56 19 com.apple.avfoundation 0x00007fff934bbd1c -[AVAssetInspectorLoader _setStatus:figErrorCode:] + 296 20 com.apple.avfoundation 0x00007fff934bcabc -[AVFormatReaderInspectorLoader cancelLoading] + 94 21 com.apple.WebCore 0x000000010edc096f WebCore::MediaPlayerPrivateAVFoundationObjC::cancelLoad() + 303 22 com.apple.WebCore 0x000000010edc062b WebCore::MediaPlayerPrivateAVFoundationObjC::~MediaPlayerPrivateAVFoundationObjC() + 43 23 com.apple.WebCore 0x000000010edc05f5 WebCore::MediaPlayerPrivateAVFoundationObjC::~MediaPlayerPrivateAVFoundationObjC() + 21 24 com.apple.WebCore 0x000000010edc058d WebCore::MediaPlayerPrivateAVFoundationObjC::~MediaPlayerPrivateAVFoundationObjC() + 29 25 com.apple.WebCore 0x000000010edbaa2e void WTF::deleteOwnedPtr<WebCore::MediaPlayerPrivateInterface>(WebCore::MediaPlayerPrivateInterface*) + 46 26 com.apple.WebCore 0x000000010edbaa58 WTF::OwnPtr<WebCore::MediaPlayerPrivateInterface*>::~OwnPtr() + 24 27 com.apple.WebCore 0x000000010edba4d5 WTF::OwnPtr<WebCore::MediaPlayerPrivateInterface*>::~OwnPtr() + 21 28 com.apple.WebCore 0x000000010edb7a99 WebCore::MediaPlayer::~MediaPlayer() + 105 29 com.apple.WebCore 0x000000010edb7a25 WebCore::MediaPlayer::~MediaPlayer() + 21 30 com.apple.WebCore 0x000000010edb79bd WebCore::MediaPlayer::~MediaPlayer() + 29 31 com.apple.WebCore 0x000000010e67866e void WTF::deleteOwnedPtr<WebCore::MediaPlayer>(WebCore::MediaPlayer*) + 46 32 com.apple.WebCore 0x000000010e6784f7 WTF::OwnPtr<WebCore::MediaPlayer>::clear() + 39 33 com.apple.WebCore 0x000000010e676a9a WebCore::HTMLMediaElement::userCancelledLoad() + 122 34 com.apple.WebCore 0x000000010e676cd7 WebCore::HTMLMediaElement::stop() + 119 35 com.apple.WebCore 0x000000010e676c55 non-virtual thunk to WebCore::HTMLMediaElement::stop() + 37 36 com.apple.WebCore 0x000000010f1b662c WebCore::ScriptExecutionContext::stopActiveDOMObjects() + 364 398927 1 eric.carlson 2011-05-05 12:30:17 -0700 <rdar;//problem/9382942> 398945 2 92451 eric.carlson 2011-05-05 12:49:25 -0700 Created attachment 92451 Proposed patch. 398972 3 eric.carlson 2011-05-05 13:24:23 -0700 http://trac.webkit.org/changeset/85872 399138 4 webkit.review.bot 2011-05-05 16:06:52 -0700 http://trac.webkit.org/changeset/85872 might have broken GTK Linux 32-bit Debug The following tests are not passing: svg/W3C-SVG-1.1/animate-elem-46-t.svg 415176 5 ademar 2011-06-03 14:05:17 -0700 Revision r85872 cherry-picked into qtwebkit-2.2 with commit db27609 <http://gitorious.org/webkit/qtwebkit/commit/db27609> 92451 2011-05-05 12:49:25 -0700 2011-05-05 12:54:19 -0700 Proposed patch. patch_2.txt text/plain 4161 eric.carlson SW5kZXg6IFNvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2Vi Q29yZS9DaGFuZ2VMb2cJKHJldmlzaW9uIDg1ODY4KQorKysgU291cmNlL1dlYkNvcmUvQ2hhbmdl TG9nCSh3b3JraW5nIGNvcHkpCkBAIC0xLDMgKzEsMjEgQEAKKzIwMTEtMDUtMDUgIEVyaWMgQ2Fy bHNvbiAgPGVyaWMuY2FybHNvbkBhcHBsZS5jb20+CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9C T0RZIChPT1BTISkuCisKKyAgICAgICAgQmxvY2sgY2FsbGJhY2tzIGRlbGl2ZXJlZCBkdXJpbmcg ZGVzdHJ1Y3Rpb24KKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dp P2lkPTYwMjkxCisKKyAgICAgICAgTm8gbmV3IHRlc3RzLCB0ZXN0ZWQgYnkgZXhpc3RpbmcgdGVz dHMuCisKKyAgICAgICAgKiBwbGF0Zm9ybS9ncmFwaGljcy9hdmZvdW5kYXRpb24vTWVkaWFQbGF5 ZXJQcml2YXRlQVZGb3VuZGF0aW9uLmNwcDoKKyAgICAgICAgKFdlYkNvcmU6Ok1lZGlhUGxheWVy UHJpdmF0ZUFWRm91bmRhdGlvbjo6fk1lZGlhUGxheWVyUHJpdmF0ZUFWRm91bmRhdGlvbik6IENh bGwgCisgICAgICAgICAgICBzZXRJZ25vcmVMb2FkU3RhdGVDaGFuZ2VzKHRydWUpIHRvIGNhbmNl bCBhbGwgY2FsbGJhY2tzLgorICAgICAgICAoV2ViQ29yZTo6TWVkaWFQbGF5ZXJQcml2YXRlQVZG b3VuZGF0aW9uOjp1cGRhdGVTdGF0ZXMpOiBSZXR1cm4gaW1tZWRpYXRlbHkgaWYgCisgICAgICAg ICAgICBtX2lnbm9yZUxvYWRTdGF0ZUNoYW5nZXMgaXMgdHJ1ZS4KKyAgICAgICAgKFdlYkNvcmU6 Ok1lZGlhUGxheWVyUHJpdmF0ZUFWRm91bmRhdGlvbjo6ZGlzcGF0Y2hOb3RpZmljYXRpb24pOiBs b2FkU3RhdGVDaGFuZ2VkIC0+IHVwZGF0ZVN0YXRlcy4KKyAgICAgICAgICAgIERvbid0IGNhbGwg dXBkYXRlU3RhdGVzIGFmdGVyIGNhbGxpbmcgbG9hZGVkVGltZVJhbmdlc0NoYW5nZWQsIGl0IGFs cmVhZHkgZG9lcyBpdC4KKyAgICAgICAgKiBwbGF0Zm9ybS9ncmFwaGljcy9hdmZvdW5kYXRpb24v TWVkaWFQbGF5ZXJQcml2YXRlQVZGb3VuZGF0aW9uLmg6CisKIDIwMTEtMDUtMDUgIEJoYXJhdGh3 YWFqIFNyaW5pdmFzYW4gIDxiaGFyYXRod2Fhai5zQGdtYWlsLmNvbT4KIAogICAgICAgICBSZXZp ZXdlZCBieSBIb2xnZXIgRnJleXRoZXIuCkluZGV4OiBTb3VyY2UvV2ViQ29yZS9wbGF0Zm9ybS9n cmFwaGljcy9hdmZvdW5kYXRpb24vTWVkaWFQbGF5ZXJQcml2YXRlQVZGb3VuZGF0aW9uLmNwcAo9 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09Ci0tLSBTb3VyY2UvV2ViQ29yZS9wbGF0Zm9ybS9ncmFwaGljcy9hdmZvdW5kYXRp b24vTWVkaWFQbGF5ZXJQcml2YXRlQVZGb3VuZGF0aW9uLmNwcAkocmV2aXNpb24gODU4NjUpCisr KyBTb3VyY2UvV2ViQ29yZS9wbGF0Zm9ybS9ncmFwaGljcy9hdmZvdW5kYXRpb24vTWVkaWFQbGF5 ZXJQcml2YXRlQVZGb3VuZGF0aW9uLmNwcAkod29ya2luZyBjb3B5KQpAQCAtNzksNiArNzksNyBA QCBNZWRpYVBsYXllclByaXZhdGVBVkZvdW5kYXRpb246Ok1lZGlhUGxhCiBNZWRpYVBsYXllclBy aXZhdGVBVkZvdW5kYXRpb246On5NZWRpYVBsYXllclByaXZhdGVBVkZvdW5kYXRpb24oKQogewog ICAgIExPRyhNZWRpYSwgIk1lZGlhUGxheWVyUHJpdmF0ZUFWRm91bmRhdGlvbjo6fk1lZGlhUGxh eWVyUHJpdmF0ZUFWRm91bmRhdGlvbiglcCkiLCB0aGlzKTsKKyAgICBzZXRJZ25vcmVMb2FkU3Rh dGVDaGFuZ2VzKHRydWUpOwogICAgIGNhbmNlbENhbGxPbk1haW5UaHJlYWQobWFpblRocmVhZENh bGxiYWNrLCB0aGlzKTsKIH0KIApAQCAtMzgyLDYgKzM4Myw5IEBAIGJvb2wgTWVkaWFQbGF5ZXJQ cml2YXRlQVZGb3VuZGF0aW9uOjpzdXAKIAogdm9pZCBNZWRpYVBsYXllclByaXZhdGVBVkZvdW5k YXRpb246OnVwZGF0ZVN0YXRlcygpCiB7CisgICAgaWYgKG1faWdub3JlTG9hZFN0YXRlQ2hhbmdl cykKKyAgICAgICAgcmV0dXJuOworCiAgICAgTWVkaWFQbGF5ZXI6Ok5ldHdvcmtTdGF0ZSBvbGRO ZXR3b3JrU3RhdGUgPSBtX25ldHdvcmtTdGF0ZTsKICAgICBNZWRpYVBsYXllcjo6UmVhZHlTdGF0 ZSBvbGRSZWFkeVN0YXRlID0gbV9yZWFkeVN0YXRlOwogCkBAIC01MDgsMTMgKzUxMiw2IEBAIHZv aWQgTWVkaWFQbGF5ZXJQcml2YXRlQVZGb3VuZGF0aW9uOjptZXQKICAgICB1cGRhdGVTdGF0ZXMo KTsKIH0KIAotdm9pZCBNZWRpYVBsYXllclByaXZhdGVBVkZvdW5kYXRpb246OmxvYWRTdGF0ZUNo YW5nZWQoKQotewotICAgIGlmIChtX2lnbm9yZUxvYWRTdGF0ZUNoYW5nZXMpCi0gICAgICAgIHJl dHVybjsKLSAgICB1cGRhdGVTdGF0ZXMoKTsKLX0KLQogdm9pZCBNZWRpYVBsYXllclByaXZhdGVB VkZvdW5kYXRpb246OnJhdGVDaGFuZ2VkKCkKIHsKICAgICB1cGRhdGVTdGF0ZXMoKTsKQEAgLTcz MCwyOCArNzI3LDI2IEBAIHZvaWQgTWVkaWFQbGF5ZXJQcml2YXRlQVZGb3VuZGF0aW9uOjpkaXMK ICAgICAgICAgdXBkYXRlU3RhdGVzKCk7CiAgICAgICAgIGJyZWFrOwogICAgIGNhc2UgTm90aWZp Y2F0aW9uOjpJdGVtU3RhdHVzQ2hhbmdlZDoKLSAgICAgICAgbG9hZFN0YXRlQ2hhbmdlZCgpOwor ICAgICAgICB1cGRhdGVTdGF0ZXMoKTsKICAgICAgICAgYnJlYWs7CiAgICAgY2FzZSBOb3RpZmlj YXRpb246Okl0ZW1TZWVrYWJsZVRpbWVSYW5nZXNDaGFuZ2VkOgogICAgICAgICBzZWVrYWJsZVRp bWVSYW5nZXNDaGFuZ2VkKCk7Ci0gICAgICAgIGxvYWRTdGF0ZUNoYW5nZWQoKTsKICAgICAgICAg YnJlYWs7CiAgICAgY2FzZSBOb3RpZmljYXRpb246Okl0ZW1Mb2FkZWRUaW1lUmFuZ2VzQ2hhbmdl ZDoKICAgICAgICAgbG9hZGVkVGltZVJhbmdlc0NoYW5nZWQoKTsKLSAgICAgICAgbG9hZFN0YXRl Q2hhbmdlZCgpOwogICAgICAgICBicmVhazsKICAgICBjYXNlIE5vdGlmaWNhdGlvbjo6SXRlbVBy ZXNlbnRhdGlvblNpemVDaGFuZ2VkOgogICAgICAgICBzaXplQ2hhbmdlZCgpOwogICAgICAgICB1 cGRhdGVTdGF0ZXMoKTsKICAgICAgICAgYnJlYWs7CiAgICAgY2FzZSBOb3RpZmljYXRpb246Okl0 ZW1Jc1BsYXliYWNrTGlrZWx5VG9LZWVwVXBDaGFuZ2VkOgotICAgICAgICBsb2FkU3RhdGVDaGFu Z2VkKCk7CisgICAgICAgIHVwZGF0ZVN0YXRlcygpOwogICAgICAgICBicmVhazsKICAgICBjYXNl IE5vdGlmaWNhdGlvbjo6SXRlbUlzUGxheWJhY2tCdWZmZXJFbXB0eUNoYW5nZWQ6Ci0gICAgICAg IGxvYWRTdGF0ZUNoYW5nZWQoKTsKKyAgICAgICAgdXBkYXRlU3RhdGVzKCk7CiAgICAgICAgIGJy ZWFrOwogICAgIGNhc2UgTm90aWZpY2F0aW9uOjpJdGVtSXNQbGF5YmFja0J1ZmZlckZ1bGxDaGFu Z2VkOgotICAgICAgICBsb2FkU3RhdGVDaGFuZ2VkKCk7CisgICAgICAgIHVwZGF0ZVN0YXRlcygp OwogICAgICAgICBicmVhazsKICAgICBjYXNlIE5vdGlmaWNhdGlvbjo6UGxheWVyUmF0ZUNoYW5n ZWQ6CiAgICAgICAgIHJhdGVDaGFuZ2VkKCk7CkluZGV4OiBTb3VyY2UvV2ViQ29yZS9wbGF0Zm9y bS9ncmFwaGljcy9hdmZvdW5kYXRpb24vTWVkaWFQbGF5ZXJQcml2YXRlQVZGb3VuZGF0aW9uLmgK PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PQotLS0gU291cmNlL1dlYkNvcmUvcGxhdGZvcm0vZ3JhcGhpY3MvYXZmb3VuZGF0 aW9uL01lZGlhUGxheWVyUHJpdmF0ZUFWRm91bmRhdGlvbi5oCShyZXZpc2lvbiA4NTg2NSkKKysr IFNvdXJjZS9XZWJDb3JlL3BsYXRmb3JtL2dyYXBoaWNzL2F2Zm91bmRhdGlvbi9NZWRpYVBsYXll clByaXZhdGVBVkZvdW5kYXRpb24uaAkod29ya2luZyBjb3B5KQpAQCAtNDIsNyArNDIsNiBAQCBw dWJsaWM6CiAKICAgICB2aXJ0dWFsIHZvaWQgcmVwYWludCgpOwogICAgIHZpcnR1YWwgdm9pZCBt ZXRhZGF0YUxvYWRlZCgpOwotICAgIHZpcnR1YWwgdm9pZCBsb2FkU3RhdGVDaGFuZ2VkKCk7CiAg ICAgdmlydHVhbCB2b2lkIHBsYXlhYmlsaXR5S25vd24oKTsKICAgICB2aXJ0dWFsIHZvaWQgcmF0 ZUNoYW5nZWQoKTsKICAgICB2aXJ0dWFsIHZvaWQgbG9hZGVkVGltZVJhbmdlc0NoYW5nZWQoKTsK